09-09-2026
Once in a BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Exploit Chain Using Chrome and Windows Zero-Days
https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit
Report completeness: High
Actors/Campaigns:
Apt31 (motivation: cyber_espionage)
Unk_latenight (motivation: cyber_espionage)
Unk_doublecheck (motivation: cyber_espionage)
Unk_quietracket (motivation: cyber_espionage)
Threats:
Bluemoon_exploitkit
Spear-phishing_technique
Process_injection_technique
Wuhan
Shadowpad
Dll_sideloading_technique
Victims:
Non governmental organizations, Mining, Physical commodity trading, Aerospace, Manufacturing, Government, Consulting, Financial sector
Industry:
Aerospace, Ngo, Government
Geo:
United states, Vietnamese, Indonesian, Asian, Singapore, Indonesia, China
CVEs:
CVE-2026-85880 [Vulners]
CVSS V3.1: Unknown,
Vulners: Exploitation: Unknown
CVE-2026-85046 [Vulners]
CVSS V3.1: Unknown,
Vulners: Exploitation: Unknown
TTPs:
Tactics: 3
Technics: 0
ChatGPT TTPs:
do not use without manual checkT1020, T1027, T1027.013, T1036, T1040, T1053.005, T1055, T1056.001, T1057, T1068, have more...
IOCs:
File: 10
Path: 2
Domain: 54
Url: 18
Command: 1
Coin: 1
Hash: 17
Email: 13
IP: 1
Soft:
Chrome, Chromium, Windows kernel, Windows kernel Local, Microsoft Edge, curl, Google Chrome, Vivaldi, task scheduler, Firefox, have more...
Algorithms:
aes, zip, base64, sha256, chacha20, hmac, xor
Functions:
fill, WebAssembly
Win API:
CreateProcess, SeDebugPrivilege, CreateProcessA
Languages:
rust, javascript
Links:
https://github.com/google/security-research/tree/master/v8ctf